[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators:

o trust context is a connection to one resource utilizing one network identity and one privilege for that identity (e.g. read, write, delete, etc.) or even a single operation (similar to an API call).
This would be the ideal case, but implementations may not allow this fine grain of control and may define sessions as broadly as 'connection to a resource by a network identity with set privileges for a period of time' with reauthentication and reauthorization needed for increased privilege, after a set time period, or an operational change is detected.

Planning for a Zero Trust Architecture_ A Planning Guide for Federal Administrators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Guidelines for Media Sanitization:

3.2.2. 3.2.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities:

- GLYPH<c=31,font=/KKMIHL+Webdings> Training. For the purposes of this publication, training refers only to informing personnel of their roles and responsibilities within a particular IT plan and teaching them skills related to those roles and responsibilities, thereby preparing them for participation in exercises, tests, and actual emergency situations related to the IT plan. Training personnel on their roles and responsibilities before an exercise or test event is typically split between a presentation on their roles and responsibilities, and activities that allow personnel to demonstrate their understanding of the subject matter. - GLYPH<c=31,font=/KKMIHL+Webdings> Exercises. An exercise is a simulation of an emergency designed to validate the viability of one or more aspects of an IT plan. In an exercise, personnel with roles and responsibilities in a particular IT plan meet to validate the content of a plan through discussion of their roles and their responses to emergency situations, execution of responses in a simulated operational environment, or other means of validating responses that does not involve using the actual operational environment. Exercises are scenario-driven, such as a power failure in one of the organization's data centers or a fire causing certain systems to be damaged, with additional situations often being presented during the course of an exercise. There are several types of exercises, and this publication focuses on the following two types that are widely used in TT&E programs by single organizations:
- -Tabletop Exercises. Tabletop exercises are discussion-based exercises where personnel meet in a classroom setting or in breakout groups to discuss their roles during an emergency and their responses to a particular emergency situation.

Guide to Test, Training, and Exercise Programs for IT Plans and Capabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.1 (NIST 3.2.1)?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

3.2.1 Common Notions of Protection 3-3 3. 3.2.1 Common Notions of Protection

"Conventional wisdom" holds that the military is concerned only with protecting the confidentiality of classified information.

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Zero Trust Architecture:

| ACT-IAC   | American Council for Technology and Industry Advisory Council. (2019). Zero Trust Cybersecurity Current Trends . Disponible en https://www.actiac.org/zero- trust-cybersecurity-current-trends                                                                                |
|-----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Anderson  | Anderson B., McGrew D. (2017). Machine Learning for Encrypted Malware Traffic Classification: Accounting for Noisy Labels and Non- Stationarity. Proceedings of the 23rd ACMSIGKDD International Conference on Knowledge Discovery and Data Mining (ACM, Halifax, Nova Scotia, Canada), pp. 1723-1732. https://doi.org/10.1145/3097983.3098163                  |
| BCORE     | Department of Defense CIO. (2007). Department of Defense Global Information Grid Architecture Vision Version 1.0 June 2007. Disponible en http://www.acqnotes.com/Attachments/DoD%20GIG%20Architectural% 20Vision,%20June%2007.pdf                                                                                |
| CSA-SDP   | Cloud Security Alliance. (2015). SDP Specification 1.0. Disponible en https://cloudsecurityalliance.org/artifacts/sdp-specification-v1-0/                                                                                |
| FIPS199   | National Institute of Standards and Technology. (2004). Standards for Security Categorization of Federal Information and Information Systems. (U.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation:

3.1.1. 3.1.1) • Deprecated the CHUID data object's Authentication Key Map data element • Deprecated the Printed Information data object's Employee Affiliation Line 2 data element (tag 0x03) • Removed size limits on signed data object containers (Part 1, Appendix A) |

| Version     | Release Date   | Updates                                                                                |
|-------------|----------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| SP 800-73-3 | February 2010  | • Added preamble: I - Revision History, II - Configuration Management, and III - NPIVP Conformance Testing (Part 1, Preamble) • Removed the CHUID data object's Authentication Key Map data element • Removed the Printed Information data object's Employee Affiliation Line 2 data element (tag 0x03) • Deprecated IPv6 as optional value for the CHUID's GUID data element (Part 1, Sec.

Interfaces for Personal Identity Verification_ Part 1 – PIV Card Application Namespace, Data Model and Representation


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE) provide? (Part 2)

[Assistant]
and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: nistir8294-comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Electric vehicles are becoming common on the Nation's roads, and the electric vehicle supply equipment infrastructure (EVSE) is being created to support that growth. The NIST Information Technology Lab (ITL) hosted a one-day symposium to showcase federally funded research into the potential cybersecurity implications of EVSE.

Symposium on Federally Funded Research on Cybersecurity of Electric Vehicle Supply Equipment (EVSE)

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio:

3.1.2. 3.1.2.

Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography:

| Incorporating Key Confirmation into a C(0e, 2s) Scheme ..............................
107 6.3.3.1 C(0e, 2s) Scheme with Unilateral Key Confirmation Provided by Party             |
|                                                                                | 6.3.3.2                                                                                | C(0e, 2s) Scheme with Unilateral Key Confirmation Provided by Party V to Party U...................................................................................... 109        |
|                                                                                | 6.3.3.3                                                                                | C(0e, 2s) Scheme with Bilateral Key Confirmation ......................... 110                                                                                |
| 7. Rationale for Selecting a Specific Scheme........................................................ 112                                                                          | 7. Rationale for Selecting a Specific Scheme........................................................ 112                                                                          | 7. Rationale for Selecting a Specific Scheme........................................................

Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Media Protection?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

IT may include information from EV/XFC partners, utility/building management partners, and suppliers/vendors. Utility/building management owners/operators may consider encrypting all operational data.
| ISA/IEC 62443-2- 1:D4E1 NET 1.01, NET 1.06, NET 1.08, DATA 1.2, DATA 1.6, USER 1.16 ISA/IEC 62443-3- 3:2013 SR 3.1, SR 3.8, SR 4.1, SR 4.2 |
| DS-3: Assets are formally managed throughout removal, transfer, and disposition. | Ecosystem: Manage assets, which may include hardware, software, information databases, and developmental/operational tools or systems and the data itself. In addition to the day-to-day management activities, formal asset management includes creating, using, and updating asset management activities or strategies. | [NIST-SP800-53r5] CM-8, MP-6, PE-16, PE-20 NERC CIP 011-2-R2                                                                               |
| DS-3 | EV                                                                        | Managed data may include information on vehicle performance, battery performance, charging history, location history, and vehicle owners from EV/XFC partners, and suppliers/vendors. Transfer of EV assets should consider including encryption and authentication protocols and should consider only being managed by authorized parties. Consider going through a formal provision process when updating firmware and verifying that updates can only be made by a certified party. Consider including guidelines for data retention, backup, and secure disposal in any procedures. | [NIST-SP800-53r5] CM-8, MP-6, PE-16, PE-20 ISO 24089:2023 5.3.4.1, 7.3.1.3, 7.3.4.7, 9.3.2.7                                               |
| DS-3 | XFC/EVSE                                                                  | Associated data may include information from EV owners, EV/XFC partners, and suppliers/vendors.

Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CM.L2-3.4.6 (NIST 3.4.6)?

[Assistant]
According to Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure:

3.4.6, 6.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide:

.......................................................................75                                                                                |
| 5.4.1.
Business Associate Contracts or Other Arrangements (§ 164.314(a)).......................................77                                                                                |
| 5.4.2. Requirements for Group Health Plans (§ 164.314(b))................................................................79                                                                                |
| 5.5.1. Policies and Procedures (§ 164.316(a))......................................................................................81                                                                                |
| 5.5.2. Documentation (§ 164.316(b))...................................................................................................83                                                                                |
| References.......................................................................................................................................85                                                                                |
| Appendix A. List of Symbols, Abbreviations, and Acronyms...............................................................87                                                                                |
| Appendix B. Glossary .......................................................................................................................91                                                                                |
| Appendix C.

Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule_ A Cybersecurity Resource Guide


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Automation Support for Security Control Assessments_ Software Asset Management provide? (Part 2)

[Assistant]
ral agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST information security publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 Email: sec-cert@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof-of-concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal systems. ## Abstract

The NISTIR 8011 volumes each focus on an individual information security capability, adding tangible detail to the more general overview given in NISTIR 8011 Volume 1, and providing a template for transition to a detailed, NIST guidance-based automated assessment.

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne:

CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B

Hawes D, Calis A, Crombie R (2023) Cryptographic Module Validation Program (CMVP) Security Policy Requirements: CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) NIST SP 800-140Br1. https://doi.org/10.6028/NIST.SP.800-140Br1

Cryptographic Module Validation Program (CMVP) Security Policy Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759 and ISO_IEC 19790 Anne


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.1 (NIST 3.5.1)?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

3.5.1. 3.5.1.

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Security Guidance for First Responder Mobile and Wearable Devices provide? (Part 2)

[Assistant]
es  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.
For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. Submit comments on this publication to: NISTIR8235\_Comments@nist.gov

National Institute of Standards and Technology Attn: Applied Cybersecurity Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. ## Abstract

Public safety officials utilizing public safety broadband networks will have access to devices, such as mobile devices, tablets and wearables. These devices offer new ways for first responders to complete their missions but may also introduce new security vulnerabilities to their work environment.

Security Guidance for First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities:

Secure Coding Principles             | . . . . . . . . . . . . |  47 |
|      | 9.1. | Input/Output Check Safety . . . . . . . . . . . . . . . |  47 |
|      | 9.2. | Memory Safety . . . . . . . . . .
|  48 |
|      | 9.3. | Data Type Safety . . . . . . . . . . . . . . . . . . |  50 |
| 10. | BF Tools . . . . . . | . . . . . . . . . . . . . . . |  52 |
|      | 10.1. BFCWE Tool 10.2. | . . . . . . . . . . . . . . . . . . |  52 |
|      | BFCVE Tool                              | . . . . . . . . . . . . . . . . . . |  53 |

Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to U.S. Department of Energy Risk Assessment Methodology:

## U.S. DEPARTMENT OF ENERGY RISK ASSESSMENT METHODOLOGY

Volume I: DOE Risk Assessment Guideline Instructions, Resource Tabie, and Compieted Sampie

Voiume II: DOE Risk Assessment Woiksheets

U.S. Department of Energy Risk Assessment Methodology


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to CMVP Approved Authentication Mechanisms_ CMVP Validation Authority Requirements for ISO_IEC 19790 Annex E and ISO_IEC 24579 Section 6.17:

authentication; Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140; ISO/IEC 19790; ISO/IEC 24759; testing requirement; vendor evidence; vendor documentation.

This document is focused toward the vendors, testing labs, and CMVP for the purpose of addressing authentication issues in cryptographic module design, manufacture, and testing.

This document specifies the Cryptographic Module Validation Program (CMVP) modifications of the methods to be used by a Cryptographic and Security Testing Laboratory (CSTL) to demonstrate conformance. This document also specifies the modification of methods for evidence that a vendor or testing laboratory provides to demonstrate conformity. The approved sensitive security parameter generation and establishment methods specified in this document supersede those specified in ISO/IEC 19790 Annex E and ISO/IEC 24759 paragraph 6.17.

CMVP Approved Authentication Mechanisms_ CMVP Validation Authority Requirements for ISO_IEC 19790 Annex E and ISO_IEC 24579 Section 6.17


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

The organization should collect and analyze available data about the state of the system regularly and as often as needed to manage security and privacy risks, as appropriate for each level of the organization (i.e., governance level, mission or business process level, and information systems level)  [Dem10]. Continuous monitoring of information security requires maintaining ongoing awareness of privacy and security controls, vulnerabilities, and threats to support risk management  decisions. The  goal  is  to  conduct  ongoing  monitoring  of  the  security  of  an organization's  networks,  information,  and  systems,  and  to  respond  by  accepting,  avoiding,  or mitigating risk as situations change. -  Staff  Specialization. Cloud  providers,  just  as  other  organizations  with  large-scale computing facilities, have an opportunity for staff to specialize in security, privacy, and other  areas  of  high  interest  and  concern  to  the  organization. Increases  in  the  scale  of computing induce specialization, which in turn allows security staff to shed other duties and concentrate exclusively on security and privacy issues. Through  increased specialization, there is an opportunity for staff members to gain in-depth experience and training,  take  remedial  actions,  and  make  improvements  to  security  and  privacy  more readily than otherwise would be possible with a more diverse set of duties. -  Platform  Strength. The  structure  of  cloud  computing  platforms  is  typically  more uniform  than  that  of  most  traditional  computing  centers. Greater  uniformity  and homogeneity  facilitate  platform  hardening  and  enable  better  automation  of  security management  activities  like  configuration  control,  vulnerability  testing,  security  audits, and  security  patching  of  platform  components.

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Guidelines for API Protection for Cloud-Native Systems:

...............14                     |
| 2.7.5. Reaching Out to Other Systems .................................................................................................15            |
| 2.7.7.
Identity Canonicalization............................................................................................................16      |
| 3. Recommended Controls for APIs...................................................................................................17               |
| 3.1.1. Basic Pre-Runtime Protections...................................................................................................18           |
| 3.1.2. Advanced Pre-Runtime Protections ...........................................................................................19               |
| 3.2.1. Basic Runtime Protections..........................................................................................................20        |

Guidelines for API Protection for Cloud-Native Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

and  security  for  wireless  implantable  medical  devices,' Proceedings  of  the  28th  international  conference  on  Human  factors  in computing systems, ACM New York, NY, USA, 2010, pp 917-926.
- [7] National Institute of Standards and Technology 'FIPS Pub 199: Standards for Security Categorization of Federal Information and Information  Systems,'  FEDERAL  INFORMATION  PROCESSING STANDARDS PUBLICATION, February 2004. - [8] S. Fischer and M. Zitterbart, 'Security in Sensor Networks,' Information Technology: Vol. 52, No. 6, 2010, pp. 311-312.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Measuring the Usability and Security of Permuted Passwords on Mobile Platforms provide?

[Assistant]
## NISTIR 8040

## Measuring the Usability and Security of Permuted Passwords on Mobile Platforms

Kristen K. Greene John Kelsey

Joshua M. Franklin

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8040

<!-- image -->

## NISTIR 8040

## Measuring the Usability and Security of Permuted Passwords on Mobile Platforms

Kristen K. Greene Information Access Division Information Technology Laboratory

John Kelsey Computer Security Division Information Technology Laboratory

Joshua M. Franklin Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8040

April 2016

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

## National Institute of Standards and Technology Internal Report 8040 65 pages (April 2016)

## This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.IR.8040

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Measuring the Usability and Security of Permuted Passwords on Mobile Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does General Access Control Guidance for Cloud Systems provide? (Part 3)

[Assistant]
h  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.
Many NIST cybersecurity publications, other than the ones noted above, are available at https://csrc.nist.gov/publications. ## Comments on this publication may be submitted to:

National Institute of Standards and Technology Attn: Computer Security Division, Information Technology Laboratory 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930

Email: sp800-210-comments@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA). ## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations. ## Abstract

This document presents cloud access control characteristics and a set of general access control guidance for cloud service models: IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and SaaS (Software as a Service).

General Access Control Guidance for Cloud Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Implementation of DevSecOps for a Microservices-based Application with Service Mesh:

applications. Since microservices are typically implemented as containers, a container orchestration and resource management platform are used for deployment, operations, and maintenance of services.
The purpose of creating the CI/CD pipeline is to enable frequent updates to source code, rebuilds, and the automatic deployment of updated modules into the production environment. The key tasks involved are [19]:

Implementation of DevSecOps for a Microservices-based Application with Service Mesh


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guidelines for the Secure Deployment of IPv6:

..................................................................... | Introduction ...................................................................................................................
| 1-1  |
| 1.2                                                                                | Authority.................................................................................................................1-1 Scope................................................................................................1-1 | Authority.................................................................................................................1-1 Scope................................................................................................1-1 |      |
| 1.3                                                                                | Purpose and Audience ................................................................................................................1-1                                                                                | Purpose and Audience ................................................................................................................1-1                                                                                |      |
| 1.4                                                                                |                                                                                |                                                                                |      |
| 2.

Guidelines for the Secure Deployment of IPv6


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Forensic Filtering of Cell Phone Protocols provide?

[Assistant]
<!-- image -->

NISTIR 7516

## Forensic Filtering of Cell Phone Protocols

Aurélien Delaitre Wayne Jansen

NISTIR 7516

## Forensic Filtering of Cell Phone Protocols

Aurélien Delaitre Wayne Jansen

## C  O  M  P  U  T  E  R      S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

August 2008

<!-- image -->

## U.S. Department of Commerce

Carlos M. Gutierrez, Secretary

National Institute of Standards and Technology

James M. Turner, Deputy Director ii

## Reports on Computer Systems Technology

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and  Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement  and  standards  infrastructure. ITL  develops  tests,  test  methods,  reference  data,  proof  of concept  implementations,  and  technical  analysis  to  advance  the  development  and  productive  use  of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Interagency Report discusses ITL's research,  guidance,  and  outreach  efforts  in  computer  security,  and  its  collaborative  activities  with industry, government, and academic organizations. National Institute of Standards and Technology Interagency Report 42 pages (2008)

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.

Forensic Filtering of Cell Phone Protocols

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Vulnerability Management:

Software Vulnerability Management

Software Vulnerability Management

The NISTIR 8011 capability-specific volumes focus on the automation of security control assessment within each individual information security capability. The capability-specific volumes add tangible detail to the more general overview given in NISTIR 8011 Volume 1, providing a template for transition to a detailed, NIST standards-compliant automated assessment. This document, Volume 4 of NISTIR 8011, addresses automating the assessment of security controls that support the software vulnerability management security capability to facilitate the management of risk created by defects present in software on the network. Software vulnerability management, in the scope of this document, focuses on known defects that have been discovered in software in use on a system. The Common Weakness Enumeration (CWE) provides identifiers for weaknesses that result from poor coding practices and have the potential to result in software vulnerabilities. The Common Vulnerabilities and Exposures (CVEs) program provides a list of many known vulnerabilities. Together, CVE and CWE are used to identify software defects and the weaknesses that cause a given defect. Vulnerable software is a key target that attackers use to initiate an attack internally and to expand control.

Automation Support for Security Control Assessments_ Software Vulnerability Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Measurement Guide for Information Security_ Volume 1 — Identifying and Selecting Measures


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information  systems. The  Special  Publication  (SP)  800-series  reports  on  ITL's  research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. Organizations will increasingly use Internet of Things (IoT) devices for the mission benefits they can offer, but care must be taken in the acquisition and implementation of IoT devices. This publication contains background and recommendations to help organizations consider how an IoT device they plan to acquire can integrate into a system.

IoT Device Cybersecurity Guidance for the Federal Government_ Establishing IoT Device Cybersecurity Requirements


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guidelines on Electronic Mail Security provide? (Part 4)

[Assistant]
--------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------|
| 1.
| Introduction ......................................................................................................................1-1 1.1 | Authority...................................................................................................................1-1                                                         | Summary..............................................................................................................ES-1   |
|    | 1.2                                                                                | Purpose and Scope .................................................................................................1-1                                                                  | Summary..............................................................................................................ES-1   |
|    | 1.3                                                                                | Audience and Assumptions .....................................................................................1-2                                                                       | Summary..............................................................................................................ES-1   |
|    | 1.4 Document Organization                                                                                | ...........................................................................................1-2                                                                                | Summary..............................................................................................................ES-1   |
| 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Information System Security Best Practices for UOCAVA-Supporting Systems:

Many jurisdictions make voter registration and ballot request forms available on their web sites, or are willing to e-mail them to voters upon request. Depending on local procedures and state law, some jurisdictions will accept completed voter registration or ballot request forms from voters over e-mail or allow voters to upload scanned forms to web sites. A growing number of jurisdictions are creating web sites that allow voters to fill out a web form to submit updates to their voter registration information. In these cases, proper operational, managerial and technical security controls must be implemented to ensure sensitive personally-identifiable material from voters is kept secure. Computer management entails any modification to the computer that changes the way that the computer operates. Management access control is restricting who can manage the computer to a limited number of known people. For example, on a PC used in a personal work setting, setting the electronic clock back by an hour will have minimal impact on the use of the computer; on a server that is handling requests for electronic ballots, making such a change (even with auditing) could have huge effects on the security of the voting system. Other management tasks can similarly be benign or serious; changes such as rebooting, patching the operating system, limiting the ability of a user to write files over a certain size, or even where DNS resolution information is obtained need to be considered in light of all the operational uses of the computer. Similarly, one might allow certain people rights to change only a few settings on a server, but it is almost impossible to prevent anyone from rebooting a computer if they have physical access to it. Every server has at least one way to manage it, and often has at least a few. Some servers are managed directly on the server themselves, using keyboards and monitors attached directly to the servers.

Information System Security Best Practices for UOCAVA-Supporting Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

Digital Identity Guidelines
Authentication and Authenticator Management

Digital Identity Guidelines
Authentication and Authenticator Management

Temoshok D, Fenton JL, Choong YY, Lefkovitz N, Regenscheid A, Galluzzo R, Richer JP
(2025) Digital Identity Guidelines: Authentication and Authenticator Management.
(National Institute of Standards and Technology, Gaithersburg, MD), NIST Special
Publication (SP) NIST SP 800-63B-4. https://doi.org/10.6028/NIST.SP.800-63B-4

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to General Access Control Guidance for Cloud Systems:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure. ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology. ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations. 1. Broad  network  access :  Cloud  services  are  available  over  the  network  and  accessible through  standard  mechanisms  that  promote  use  by  heterogeneous  thick  and  thin  client platforms  (e.g.,  mobile  phones,  tablets,  laptops,  workstations). This  raises  security concerns with regard to network access. For example, denial of service (DoS) attacks can be launched against a cloud system, rendering its resources unavailable to legitimate users. Thus, AC for network access should be managed. 2. Resource pooling :  The  computing  resources  of  a  cloud  system  (e.g.,  storage,  memory, processing, network bandwidth) are pooled to serve multiple consumers using a multitenant model (i.e., a single instance of the software and its supporting infrastructure serves multiple consumers) through different physical and virtual resources, each dynamically assigned and reassigned according to consumer demands.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Risk Assessment?

[Assistant]
According to Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

......................98      |
| Table 11. Maintenance (MA) ......................................................................................................................98      |
| Table 12.
Media Protection (MP)................................................................................................................99        |
| Table 13. Physical and Environmental Protection (PE)...............................................................................99                    |
| Table 14. Planning (PL)..............................................................................................................................100 |
| Table 15. Program Management (PM) .....................................................................................................100               |
| Table 16. Personnel Security (PS) .............................................................................................................101       |
| Table 17. PII Processing and Transparency (PT) .......................................................................................102                |
| Table 18. Risk Assessment (RA) ................................................................................................................102       |
| Table 19. System and Services Acquisition (SA)........................................................................................103                |
| Table 20. System and Communications Protection (SC)...........................................................................103                        |
| Table 21. System and Information Integrity (SI) .......................................................................................104               |
| Table 22. Supply Chain Risk Management (SR).........................................................................................105                  |
| Table 23.

Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study:

## Federal Cybersecurity Awareness Programs

## Federal Cybersecurity Awareness Programs

Prior  industry  surveys  and  research  studies  have  revealed  that  organizational  cybersecurity awareness  (hereafter  shortened  to  'security  awareness')  programs  may  face  a  number  of challenges, including lack of: leadership support; resources; and staff with sufficient background and  skills  to  implement  an  effective  and  engaging  program.  However,  no  prior  research  has explored security awareness programs specifically in the United States (U.S.) government (federal) sector.  To  address  this  gap,  NIST  conducted  a  two-phase,  mixed  methods  research  study  to understand the needs, challenges, and practices of federal security awareness programs. This report describes  the  research  background  and  methodology,  along  with  the  characteristics  of  the participants, organizations, and programs represented in the study. Research results can serve as a resource  for  federal  security  awareness  professionals,  managers,  and  organizational  decision makers to improve and advocate for their organizations' security awareness programs. Results can also inform the development of federal security awareness guidance, policies, sharing forums, and initiatives  meant  to  aid  programs  in  becoming  more  effective.  While  focused  on  the  U.S. government, findings may also have implications for organizational security awareness programs in other sectors.

Federal Cybersecurity Awareness Programs_ A Mixed Methods Research Study


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.5 (NIST 3.1.5)?

[Assistant]
According to Automation Support for Security Control Assessments_ Volume 1_ Overview:

3.1.5 Improves Risk Management by Measuring Security Results More Closely Aligned with Desired Business Results... 3.1.5 Improves Risk Management by Measuring Security Results More Closely Aligned with Desired Business Results

NIST guidance on information security risk stresses the need to focus not just on system-level risk, but also on mission-level risks (SP 800-30 and SP 800-39).

Automation Support for Security Control Assessments_ Volume 1_ Overview


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies:

cipating organizations to accept each other's security assessments in order to reuse information-system resources and/or to accept each other's assessed security posture in order to share information.
|
|---------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Risk Analysis             | See risk assessment. |
| Risk Assessment           | The process of identifying risks to organizational operations (including mission, functions, images, and reputation), organizational assets, individuals, other organizations, and the Nation, resulting from the operation of an information system. Part of risk management, incorporates threat and vulnerability analyses, and considers mitigations provided by security controls planned or in place. |
| Risk Management           | The program and supporting processes to manage information security risk to organizational operations (including mission, functions, images, and reputation), organizational assets, individuals, other organizations, and the Nation, and includes: (i) establishing the context for risk-related activities, (ii) assessing risk, (iii) responding to risk once determined, and (iv) monitoring risk over time. |
| Security Control          | A safeguard or countermeasure prescribed for an information system or an organization designed to protect the confidentiality, integrity, and availability of its information and to meet a set of defined security requirements. |
| Security Policy           | A set of criteria for the provision of security services.

Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Glossary of Key Information Security Terms:

This publication differs significantly from previous versions of NIST IR 7298. Previous versions contained a subset of basic terms that were most frequently used in NIST publications. This method was valuable, but greater demand and frequent updates to NIST's publication suite has necessitated the adoption of a more flexible solution.

## 3 Feedback & Updates

Glossary of Key Information Security Terms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Security Property Verification by Transition Model:

3.2.3.

Security Property Verification by Transition Model


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to PDA Forensic Tools_ an Overview and Analysis:

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL's responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Interagency Report discusses ITL's research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations. - Prepare a forensic copy (i.e., an identical bit-for-bit physical copy) of the acquired digital media, while preserving the acquired media's integrity. - Examine the forensic copy to recover information. - Analyze the recovered information and develop a report documenting the incriminating information uncovered. Forensic tools acquire data from a device in one of two ways: physical acquisition or logical acquisition. Physical acquisition implies a bit-by-bit copy of an entire physical store (e.g., a disk drive or RAM chip), while logical acquisition implies a bit-by-bit copy of logical storage objects (e.g. directories and files) that reside on a logical store (e.g., involving several disk drives). The difference lies in the distinction between memory as seen by a process through the operating system facilities (i.e., a logical view), versus memory as seen by the processor and other related hardware components (i.e., a physical view).

PDA Forensic Tools_ an Overview and Analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations provide? (Part 2)

[Assistant]
ions for further research, study, and guidance development. For information on NIST's Cyber Supply Chain Risk Management project, see https://csrc.nist.gov/projects/cyber-supply-chain-risk-management.
## DISCLAIMER

Any mention of commercial products or organizations is for informational purposes only; it is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the products identified are necessarily the best available for the purpose.

Case Studies in Cyber Supply Chain Risk Management_ Summary of Findings and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.2.5. 3.2.5. 3.2.5.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog:

| SU - SOFTWARE                                                                                | UPDATE.................................................................................. 27   |
|--------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------|
| (UPD) Update Capabilities ............................................................................27     |                                                                                |
| (APP) Update Application Support................................................................28           |                                                                                |
| CS - CYBERSECURITY STATE AWARENESS...................................................

IoT Device Cybersecurity Guidance for the Federal Government_ IoT Device Cybersecurity Requirement Catalog


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Discussion on the Full Entropy Assumption of the SP 800-90 Series provide?

[Assistant]
<!-- image -->

## NIST Interagency Report NIST IR 8427

## Discussion on the Full Entropy Assumption of the SP 800-90 Series

Darryl Buller Aaron Kaufer Allen Roginsky Meltem Sönmez Turan

This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8427.ipd

<!-- image -->

## NIST Interagency Report NIST IR 8427

## Discussion on the Full Entropy Assumption of the SP 800-90 Series

Darryl Buller Aaron Kaufer Cybersecurity Directorate National Security Agency

Allen Roginsky Meltem Sönmez Turan

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8427

April 2023

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

National Institute of Standards and Technology Laurie E. Locascio, NIST Director and Under Secretary of Commerce for Standards and Technology

Certain commercial equipment, instruments, software, or materials, commercial or non-commercial, are identified in this  paper  in  order  to  specify  the  experimental  procedure  adequately. Such  identification  does  not  imply recommendation or endorsement of any product or service by NIST, nor does it imply that the materials or equipment identified are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST.

Discussion on the Full Entropy Assumption of the SP 800-90 Series

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to BowTie – A deep learning feedforward neural network for sentiment analysis:

producers are competing to discover first: the companies to fix, the hackers to exploit. Patching products changes the game for hackers and slows down their progress. Thus, patching promptly is a way of staying ahead of security breaches. However, patching changes also the environment in which a cryptographic module runs and may also change the module itself, thus invalidating the previously validated configuration. Users who depend on validated cryptography face a dilemma when frequent updates and patches are important for staying ahead of the attackers, but the existing validation process does not permit rapid implementation of these updates while maintaining a validated status because of the slow human-based activities illustrated in Fig. 7.

BowTie – A deep learning feedforward neural network for sentiment analysis


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Integrating Cybersecurity and Enterprise Risk Management (ERM):

Cybersecurity risk is an important type of risk for any enterprise. Other risks include but are not limited to financial, legal, legislative, operational, privacy, reputational, safety, strategic, and supply chain risks [2]. As part of an ERM program, senior leaders (e.g., corporate officers, government senior executive staff) often have fiduciary and reporting responsibilities that other organizational stakeholders do not, so they have a unique responsibility to holistically manage the combined set of risks, including cybersecurity risk.

Cybersecurity risk is one portion of the spectrum of an enterprise's core risks. Appendix A of Playbook: Enterprise Risk Management for the U.S. Federal Government [2] defines numerous risk types, including compliance, cybersecurity ('cyber information security'), financial, legal, legislative, operational, reputational, and strategic. This list can easily be expanded to other risk disciplines, such as safety, privacy, and supply chains that ultimately anchor in ERM. In ERM, enterprises holistically manage the combined set of enterprise risks. 9

- Information regarding the risk itself, such as a detailed risk scenario description and underlying threats, vulnerabilities, assets threatened, risk category, and risk assessment results
- Roles involved in risk decisions and management (e.g., risk owner, risk manager, action owner for specific activities, stakeholders involved in risk response decisions, contractual agreements for supply chain/external partners)
- Schedule considerations, such as the date the risk was first documented, the date of the last risk assessment, completion dates for mitigations, and the date of the next expected assessment
- Risk response decisions and follow-up, including detailed plans, status, and risk indicators

Integrating Cybersecurity and Enterprise Risk Management (ERM)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for System and Communications Protection?

[Assistant]
According to Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... |
|--------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 PURPOSEANDAPPLICABILITY                                                                                | ................................................................................................... 3                                            |
| 1.2 TARGET AUDIENCE                                                                                | .................................................................................................................. 4                             |
| 1.3 ORGANIZATIONOF THIS SPECIAL PUBLICATION                                                                                | .......................................................................... 4                                                                     |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        | CHAPTERTWO THE FUNDAMENTALS............................................................................................ 5                        |
| 2.1 DEVELOPMENTAPPROACH ......................................................................................................

Enhanced Security Requirements for Protecting Controlled Unclassified Information_ A Supplement to NIST Special Publication 800-171


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook:

| Paraaraoh   |                                                       |                                                       | Pace   |
|-------------|-------------------------------------------------------|-------------------------------------------------------|--------|
|             | c. | Personnel Screening                                   | 3-6    |
|             | d. | Access Protection and Accountability                  | 3-6    |
|             | e. | Compliance Assurance                                  | 3-6    |
|             | f                                                     | Contingency and Disaster Recovery Plans               | 3-7    |
|             | g-                                                    | Approval of Methodologies                             | 3-7    |
| 303         | Risk                                                  | Assessment Process                                    | 3-7    |
| 304         | Protective Measures to Prevent Misuse and Abuse       | Protective Measures to Prevent Misuse and Abuse       | 3-10   |
| 305         | Certification                                         | Process                                               | 3-10   |
|             | a. | New or Modified Applications                          | 3-11   |
|             | b. | Recertifications                                      | 3-12   |
| 306         | Procedures for Screening Non-Federal Personnel        | Procedures for Screening Non-Federal Personnel        | 3-13   |
|             | a. | Scope and Applicability                               | 3-13   |
|             | b. | Objective                                             | 3-13   |
|             | c.

National Aeronautics and Space Administration's (NASA) Automated Information Security Handbook


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Computer Security Division 2008 Annual Report:

- Develop NIST guides for securing non-national security agency ◆◆ information systems - Issued eighteen NIST Special Publications (SP) covering  management,  operational  and  technical  security  guidance. Collaborated with the Office of the Director of National Intelligence and  the  Department  of  Defense  to  transform  the  certification  and accreditation process for information systems into a common framework for information security across the federal government. - Define  minimum  information  security  requirements  (manage-◆◆ ment,  operational,  and  technical  security  controls)  for  information and information systems in each such category - Issued revision 2 of SP 800-53, Recommended Security Controls for Federal Information Systems, in December 2007. - Identify methods for assessing effectiveness of security require-◆◆ ments - Issued SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems, in June 2008. - Establish performance measures for agency information security ◆◆ policies and practices - Issued revision 1 of SP 800-55, Performance Measurement Guide for Information Security, in July 2008. - Provide assistance to agencies and private sector ◆◆ - Conducted ongoing,  substantial  reimbursable  and  non-reimbursable  assistance support,  including  many  outreach  efforts  such  as  the  Federal  Information Systems Security Educators' Association (FISSEA), the Federal Computer Security Program Managers' Forum (FCSM Forum), the Small Business  Corner,  and  the  Program  Review  for  Information  Security Management Assistance (PRISMA). - Evaluate  security  policies  and  technologies  from  the  private ◆◆ sector and national security systems for potential federal agency use - Hosted a growing repository of federal agency security practices, public/private security practices, and security configuration checklists for  IT  products.

Computer Security Division 2008 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.4 (NIST 3.1.4)?

[Assistant]
According to An Introduction to Privacy Engineering and Risk Management in Federal Systems:

3.1.4, available at http://www.

An Introduction to Privacy Engineering and Risk Management in Federal Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to De-Identifying Government Datasets_ Techniques and Governance:

dra Wood); Tumult Labs (Gerome Miklau and David Pujol); the United Health Group (Peter Dumont and Ying Zhu); and the U.S. Agency for International Development Chief Data Officer (Brandon Pustejovsky).
Agencies should consider performing de-identification with trained individuals using software specifically designed for that purpose. While it is possible to perform de-identification with off-the-shelf software like a commercial spreadsheet or financial planning program, such programs typically lack the key functions required for sophisticated de-identification. As a result, they may encourage the use of simplistic de-identification methods, such as deleting columns that contain sensitive data categories and manually searching and removThis may result in a dataset that appears de-identified but still contains significant disclosure risks. 2 ing individual data cells that appear sensitive.

De-Identifying Government Datasets_ Techniques and Governance


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

- -Phase 2a: Planning and Design . In this phase, WLAN network architects specify the technical characteristics of the WLAN solution, such as authentication methods, and related network components, such as firewall rulesets. The WLAN network architects should also conduct a site survey to help determine the architecture of the solution and how the WLAN should be integrated with the existing authentication infrastructure, including PKI. - -Phase 2b: Procurement . This phase involves specifying the number and type of WLAN components that must be purchased, the feature sets they must support (e.g., FIPS-validated encryption modules), and any certifications they must hold (e.g., WPA2 Enterprise). - GLYPH<c=31,font=/HACNND+Webdings> Phase 3: Implementation . In this phase, procured equipment is first configured to meet operational and security requirements, and then installed and activated on a production network, with appropriate event logging enabled. - GLYPH<c=31,font=/HACNND+Webdings> Phase 4: Operations/Maintenance . This phase includes security-related tasks that an organization should perform on an ongoing basis once the WLAN is operational, including patching, periodic security assessment, log reviews, and incident handling. - GLYPH<c=31,font=/HACNND+Webdings> Phase 5 : Disposition. This phase encompasses tasks that occur after a system or its components have been retired, including preserving information to meet legal requirements, sanitizing media that might contain sensitive material, and disposing of equipment properly. Another major problem with shared key authentication is that pre-RSN IEEE 802.11 requires all devices on a WLAN to use the same WEP key or the same small set of keys. This reduces accountability and complicates troubleshooting and incident response efforts.

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0:

Critical infrastructure is defined in the EO as 'systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.' Due to the increasing pressures from external and internal threats, organizations responsible for critical infrastructure need to have a consistent and iterative approach to identifying, assessing, and managing cybersecurity risk. This approach is necessary regardless of an organization's size, threat exposure, or cybersecurity sophistication today. While the intended outcomes identified in the Functions, Categories, and Subcategories are the same for IT and ICS, the operational environments and considerations for IT and ICS differ. ICS have a direct effect on the physical world, including potential risks to the health and safety of individuals, and impact on the environment. Additionally, ICS have unique performance and reliability requirements compared with IT, and the goals of safety and efficiency must be considered when implementing cybersecurity measures.

Framework for Improving Critical Infrastructure Cybersecurity, Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

n the protection mechanisms required by the organization. - o Methods to achieve confidence -what methods the organization uses, would like to use, or have available to achieve the desired confidence.
- o Addressing evolving protection reguirements of the 1990s -how the organization sees its situation and environment changing over the next few years and how that impacts its protection requirements

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities provide? (Part 5)

[Assistant]
develops tests, test methods, reference data, proof of concept implementa/t\_i.ligaons, and technical analyses to advance the development and produc/t\_i.ligave use of informa/t\_i.ligaon technology.
ITL's responsibili/t\_i.ligaes include the development of management, administra/t\_i.ligave, technical, and physical standards and guidelines for the cost-e/uniFB00ec/t\_i.ligave security and privacy of other than na/t\_i.ligaonal security-related informa/t\_i.ligaon in federal informa/t\_i.ligaon systems. The Special Publica/t\_i.ligaon 800series reports on ITL's research, guidelines, and outreach e/uniFB00orts in informa/t\_i.ligaon system security, and its collabora/t\_i.ligave ac/t\_i.ligavi/t\_i.ligaes with industry, government, and academic organiza-/t\_i.ligaons. ## Audience

The intended audience includes security researchers, so/f\_t.ligaware and hardware developers, informa/t\_i.ligaon technology (IT) managers, and IT execu/t\_i.ligaves. i

1. Introduc/t\_i.ligaon

. . . . . . . . . ## Table of Contents

. . . . . . . . . . . . . . . | 2. | Current State of the Art . | . . . . . . . . . . . . . |   3 |
|------|-----------------------------------------|-----------------------------------------------------------------------------|-----|
| 3. | Bugs Framework Formalism . . . . . | . . . . . . . . . . . . |   5 |
|      | 3.1. | BF Opera/t_i.ligaon . . . . . . . . . . . . |   7 |
|      | 3.2. | BF Bug, Fault, and Weakness . . . . . . . . . . . . . . . . |   8 |
|      | 3.3. | BF Vulnerability . . . . . . . . |  10 |
|      | 3.4. | BF Bug Iden/t_i.liga/uniFB01ca/t_i.ligaon . . . . . . . . . . . . . . . . |  13 |
| 4. | BF Security Concepts . . | . . . . . . . . . . . . . |  14 |
| 5. | BF Bugs Models . | . . . . . . . . . . . . . . . . |  16 |
|      | 5.1. | BF Input/Output Check ( INP) Bugs Model . . . . . . |  16 |
|      | 5.2. | BF Memory ( MEM) Bugs Model                                                 |  17 |
|      | 5.3.

Bug Framework (BF)_ Formalizing Cybersecurity Weaknesses and Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Forensics Web Services (FWS) provide? (Part 2)

[Assistant]
ndation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
## Acknowledgements

The authors Anoop Singhal, Murat Gunestas and Duminda Wijesekera would like to thank their colleagues who reviewed drafts of this document and contributed to its development. A special note of thanks goes to Mark Carson, Rick Ayers, Rick Kuhn, Ramaswamy Chandramouli and Karen  Scarforne  of  NIST  for  serving  as  reviewers  for  this  document. The  authors  also acknowledge Elizabeth Lennon for her technical editing and administrative support. ## Abstract

The advance of Web services technologies promises to have far-reaching effects on the Internet and  enterprise  networks. Web  services  based  on  the  eXtensible  Markup  Language  (XML), Simple  Object  Access  Protocol  (SOAP),  and  related  open  standards,  and  deployed  in  Service Oriented Architectures (SOA) allow data and applications to interact without human intervention through  dynamic  and  ad  hoc  connections. Web  services  technology  can  be  implemented  in  a wide  variety  of architectures,  can  co-exist  with  other  technologies  and  software  design approaches, and can be adopted in an evolutionary manner without requiring major transformations to legacy applications and databases. Web  services  are  currently  a  preferred  way  to  architect  and  provide  complex  services. This complexity  arises  due  to  the  composition  of  new  services  and  dynamically  invoking  existing services. These compositions create service inter-dependencies that can be misused for monetary or other gains. When a misuse is reported, investigators have to navigate through a collection of logs  of  the  composed  services  to  recreate  the  attack.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2:

-  Languages. The SCAP languages provide standard vocabularies and conventions for expressing security policy, technical check mechanisms, and assessment results. The SCAP language specifications are Extensible Configuration Checklist Description Format (XCCDF), Open Vulnerability and Assessment Language (OVAL®), and Open Checklist Interactive Language (OCIL™). -  Reporting formats. The SCAP reporting formats provide the necessary constructs to express collected information in standardized formats. The SCAP reporting format specifications are Asset Reporting Format (ARF) and Asset Identification. Although Asset Identification is not explicitly a reporting format, SCAP uses it as a key component in identifying the assets that reports relate to. -  Enumerations. Each SCAP enumeration defines a standard nomenclature (naming format) and an official dictionary or list of items expressed using that nomenclature. The SCAP enumeration specifications are Common Platform Enumeration (CPE™), Common Configuration Enumeration (CCE™), and Common Vulnerabilities and Exposures (CVE®). -  Measurement and scoring systems. In SCAP this refers to evaluating specific characteristics of a security weakness (for example, software vulnerabilities and security configuration issues) and, based on those characteristics, generating a score that reflects their relative severity. The SCAP measurement and scoring system specifications are Common Vulnerability Scoring System (CVSS) and Common Configuration Scoring System (CCSS). -  Integrity. An SCAP integrity specification helps to preserve the integrity of SCAP content and results. Trust Model for Security Automation Data (TMSAD) is the SCAP integrity specification.

The Technical Specification for the Security Content Automation Protocol (SCAP)_ SCAP Version 1.2